gandcrab | cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87

General

Target

cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
Size

207KB
MD5

22d2ff58d5b3d09e6512c57f0c32bc06
SHA1

235592e28032f1bdeb933f95631005263d808752
SHA256

cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87
SHA512

d83c64452101d1508633870c10d2b6a3de23f81e39174089b506c49117d4f99871dfe3e9913c7e226443da98b75a1a169283862671c24d1441c71b360a02138a

Score

10^/10

gandcrab backdoor persistence ransomware

Malware Config

Signatures

GandCrab Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/452-61-0x00000000003D0000-0x00000000003E6000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gictfbpbawn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe"	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

description	ioc	process
File opened (read-only)	\??\F:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\H:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\J:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\K:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\M:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\V:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\W:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\E:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\L:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\Q:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\T:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\X:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\A:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\N:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\Z:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\G:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\I:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\O:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\P:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\R:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\S:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\U:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\Y:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
File opened (read-only)	\??\B:	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

pid	process
452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe

description	pid	process	target process
PID 452 wrote to memory of 1536	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1536	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1536	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1536	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 740	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 740	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 740	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 740	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 2044	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 2044	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 2044	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 2044	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1700	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1700	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1700	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1700	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 984	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 984	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 984	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 984	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1720	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1720	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1720	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1720	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1392	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1392	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1392	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1392	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1692	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1692	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1692	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1692	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 360	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 360	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 360	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 360	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 632	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1364	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1364	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1364	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1364	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1580	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1580	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1580	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 1580	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 652	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 512	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 512	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 512	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe
PID 452 wrote to memory of 512	452	cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe
"C:\Users\Admin\AppData\Local\Temp\cc1264939e9e5eecb07836cbde10097b70b16fbd705dcf753842721742189e87.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1536

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:740

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:2044

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1700

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:1652

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:984

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1632

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1720

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:1392

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1692

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:360

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:632

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1364

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1580

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:652

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:512

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:1188

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:896

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:940

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1696

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:1964

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1192

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:1912

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:572

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1916

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1776

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:1648

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:760

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:840

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:1280

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:268

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:856

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns2.virmach.ru
2⤵
PID:912

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns2.virmach.ru
2⤵
PID:1968

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns2.virmach.ru
2⤵
PID:916

C:\Windows\SysWOW64\nslookup.exe
nslookup gdcb.bit ns1.virmach.ru
2⤵
PID:540

C:\Windows\SysWOW64\nslookup.exe
nslookup politiaromana.bit ns1.virmach.ru
2⤵
PID:1464

C:\Windows\SysWOW64\nslookup.exe
nslookup malwarehunterteam.bit ns1.virmach.ru
2⤵
PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-92-0x0000000000000000-mapping.dmp

Download
memory/360-72-0x0000000000000000-mapping.dmp

Download
memory/452-60-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/452-61-0x00000000003D0000-0x00000000003E6000-memory.dmp

Filesize
88KB

Download
memory/452-59-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/512-77-0x0000000000000000-mapping.dmp

Download
memory/540-97-0x0000000000000000-mapping.dmp

Download
memory/572-85-0x0000000000000000-mapping.dmp

Download
memory/632-73-0x0000000000000000-mapping.dmp

Download
memory/652-76-0x0000000000000000-mapping.dmp

Download
memory/740-63-0x0000000000000000-mapping.dmp

Download
memory/760-89-0x0000000000000000-mapping.dmp

Download
memory/840-90-0x0000000000000000-mapping.dmp

Download
memory/856-93-0x0000000000000000-mapping.dmp

Download
memory/896-79-0x0000000000000000-mapping.dmp

Download
memory/912-94-0x0000000000000000-mapping.dmp

Download
memory/916-96-0x0000000000000000-mapping.dmp

Download
memory/940-80-0x0000000000000000-mapping.dmp

Download
memory/984-67-0x0000000000000000-mapping.dmp

Download
memory/1188-78-0x0000000000000000-mapping.dmp

Download
memory/1192-83-0x0000000000000000-mapping.dmp

Download
memory/1280-91-0x0000000000000000-mapping.dmp

Download
memory/1364-74-0x0000000000000000-mapping.dmp

Download
memory/1392-70-0x0000000000000000-mapping.dmp

Download
memory/1464-98-0x0000000000000000-mapping.dmp

Download
memory/1536-62-0x0000000000000000-mapping.dmp

Download
memory/1544-99-0x0000000000000000-mapping.dmp

Download
memory/1580-75-0x0000000000000000-mapping.dmp

Download
memory/1632-68-0x0000000000000000-mapping.dmp

Download
memory/1648-88-0x0000000000000000-mapping.dmp

Download
memory/1652-66-0x0000000000000000-mapping.dmp

Download
memory/1692-71-0x0000000000000000-mapping.dmp

Download
memory/1696-81-0x0000000000000000-mapping.dmp

Download
memory/1700-65-0x0000000000000000-mapping.dmp

Download
memory/1720-69-0x0000000000000000-mapping.dmp

Download
memory/1776-87-0x0000000000000000-mapping.dmp

Download
memory/1912-84-0x0000000000000000-mapping.dmp

Download
memory/1916-86-0x0000000000000000-mapping.dmp

Download
memory/1964-82-0x0000000000000000-mapping.dmp

Download
memory/1968-95-0x0000000000000000-mapping.dmp

Download
memory/2044-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads